Uninstalling the software

After 30 June 2026, the product license will be automatically removed from all computers that run these OS versions: Windows XP, Windows Vista, macOS Yosemite, macOS El Capitan, macOS Sierra, macOS High Sierra, and macOS Mojave.
After 30 June 2027, the product license will be automatically removed from all computers that run Windows Server 2003 and Windows Server 2008 (Windows 2008 R2 will continue to be supported).
Computers without a license will have all protections disabled, lose access to Collective Intelligence, stop receiving signature file updates, and cease to run assigned tasks. For more information about our End-of-Life policies, go to https://www.watchguard.com/wgrd-trust-center/end-of-life-policy.

You can uninstall the Advanced EDR software locally from the control panel of the operating system on each computer, or remotely from the Computers top menu or from the Computer protection status and Licenses lists in the security software console.

Manual uninstallation

End users can manually uninstall the security software, if the administrator has not configured an uninstallation password in the security settings profile applied to their computer. If an uninstallation password is required, the end user requires authorization or the necessary credentials to uninstall the software.

To configure or delete the agent uninstallation password, see Configuring security against protection tampering.

When you install Advanced EDR, multiple applications are installed, based on the platform:

  • Windows and macOS computers: agent and endpoint security product.

  • Linux computers: agent, endpoint security product, and kernel module.

To completely uninstall Advanced EDR, you must remove all modules. If you uninstall the endpoint security product only, the agent will install it again.

On a Windows 8 or later computer

  • Control Panel > Programs > Uninstall a program.

  • Alternatively, type 'uninstall a program' at the Windows Start screen.

On a Windows Vista, Windows 7, Windows Server 2003 or later computer

  • Control Panel > Programs and Features > Uninstall or change a program.

On a Windows XP computer

  • Control Panel > Add or remove programs.

Uninstalling the security software with the uninstallation tool

On a Windows computer, during the uninstallation process, some files or libraries might not be completely removed and cause errors. You can use the tool provided by Cytomic to completely uninstall the agent and protection.

This uninstallation process can take a few minutes. When the uninstallation completes, restart the computer.

Follow these steps:

  • Download and unzip the file GenU.zip (Password: panda).

  • Run the agent removal file GU_AGENT.exe. Restart the computer.

  • Run the protection removal file GU_PROT.exe. Restart the computer.

On a macOS computer

  • Open a Terminal window: Terminal Finder > Applications > Utilities > Terminal.

  • To uninstall the security software, run this command: sudo sh /Applications/Endpoint-Protection.app/Contents/uninstall.sh

  • To uninstall the agent, run this command: sudo sh /Applications/Management-Agent.app/Contents/uninstall.sh

On a Linux device

On Linux devices, use the desktop environment to manage the packages included in the distribution.

  • Fedora: Activities > Software > Installed

  • Ubuntu: Ubuntu software> Installed

We recommend that you use the command line as root to uninstall the product. Use these parameters:

  • --remove: Removes the security software or the agent.

  • --remove-repo: Removes the security software repository or the agent repository.

  • --totp: If two-factor authentication is enabled.

  • --pass: If agent uninstallation is password protected. See Configuring security against protection tampering.

If you want to uninstall both the security software and the agent, we recommend that you uninstall the security software first and then the agent.

To uninstall the security software and the security software repository:

$ /etc/endpoint-security/repositories/management-agent/install --remove --remove-repo

To uninstall the agent and the agent repository:

$ /etc/endpoint-security/repositories/protection-agent/install --remove --remove-repo

Manual uninstallation result

When you uninstall Advanced EDR (Cytomic agent and protection) from a computer, all data associated with the computer disappears from the management console: all counters, entries in reports, and details of the computer activity.

When you reinstall the Advanced EDR software, the associated data and counters are restored.

Uninstallation from the management console

Remote uninstallation of the security software is not supported on computers that run macOS Catalina or Big Sur. In these instances, you must uninstall the software locally on the target computer.

To uninstall the security software from Windows, Linux, or macOS computers from the management console:

  • Go to the Computers menu (or open the Licenses or Computer protection status lists), and select the checkboxes for the computers you want to uninstall the security software from.

  • From the action bar, click Delete. A confirmation dialog box opens.

  • In the confirmation dialog box, select the Uninstall the Cytomic agent from the selected computers checkbox to completely remove the Advanced EDR software.

  • To complete uninstallation on macOS computers, the security software prompts the local user of the device for the password of an account with administrative privileges.